Evolution Malta Holding Limited will pay £4.75 million under a Gambling Commission settlement published on 23 July 2026. The regulator found that five genuine Evolution games appeared on six unlicensed websites accessible at scale to consumers in Great Britain through two operators.
This update is for game suppliers, operators, compliance teams and analysts reviewing B2B market-access controls. It summarises the regulator's public statement and the supply-chain evidence it identifies. It does not name the six sites, infer unpublished customers, or assess Evolution products outside the cited case.
What the Commission announced
The Gambling Commission's news release says Evolution Malta Holding Limited will make a £4.75 million payment in lieu of a financial penalty. The company holds British gambling software and casino game-host permissions.
The regulator's full public statement connects the settlement to failures in money-laundering risk assessment, policies and controls, and customer due diligence.
The case is therefore a B2B regulatory action. It concerns how a licensed supplier understood and controlled where genuine games were being made available, not a claim that the games themselves were counterfeit.
The published evidence in figures
| Role | What it means | Where to verify |
|---|---|---|
| £4.75 million | Payment in lieu of a financial penalty under the settlement. | It should not be described as customer compensation. |
| Five games | Genuine Evolution games identified in the case. | The source does not say every Evolution title was involved. |
| Six websites | Unlicensed websites accessible at scale to British consumers. | The Commission did not name them in the news release. |
| Two operators | Businesses associated with the six websites in the findings. | BETTIMES does not infer their identities. |
| December 2023 to November 2024 | Period for the large volumes of visits cited by the regulator. | It is the published access period, not the date of the settlement. |
| 12 months | Period for an independent audit required by an additional licence condition. | The clock follows the conclusion of the licence review described in the statement. |
Keeping the units and dates attached to their roles prevents the case from becoming a vague headline about illegal websites.
Why this is a supply-chain case
A game supplier can distribute content through aggregators, platforms, hosts and operator customers. That structure creates several opportunities for a game to reach a market beyond the intended contractual route.
The Commission said Evolution's risk assessment did not adequately identify the risk that its games could be supplied to British consumers by unlicensed operators. It also found gaps between written controls and their effectiveness in practice.
The BETTIMES guides to casino game providers, iGaming platforms and remote gaming servers map those roles. The exact contractual chain in this case remains limited to what the Commission published.
Which regulatory failures were described
The public statement cites licence conditions 12.1.1 and 12.1.2 in the applicable versions. It says the company did not take appropriate steps to identify and assess money-laundering and terrorist-financing risk, did not maintain effective policies and controls to prevent games being made available through unlicensed British-facing operators, and did not sufficiently comply with customer-due-diligence requirements.
The regulator also described the risk assessment as outdated. That is material because a B2B assessment needs to change with customers, distribution routes, products, technologies and destination-market risk.
This article does not generalise those findings to another Evolution entity or another jurisdiction without a matching official record.
What the licence types tell us
Evolution Malta Holding Limited held both gambling software and game host (casino) permissions from the Commission. Those are supplier and hosting activities, not evidence that the company operated the six consumer websites.
The distinction is central to accurate reporting. The unlicensed operators supplied the consumer access described by the regulator, while Evolution's regulatory responsibility concerned its own licensed B2B supply and oversight controls.
The BETTIMES Great Britain remote casino licence guide explains the consumer-facing activity separately. One group or product can appear in several licence records without those activities becoming interchangeable.
Risk assessment versus live effectiveness
A risk assessment identifies how the business could be exposed to financial crime and defines controls proportionate to those risks. It must remain current. The Commission said the assessment in this case was not effective enough to flag the supply route and was outdated.
Live effectiveness asks whether contracts, customer due diligence, domain intelligence, game telemetry, traffic data and escalation actually identify prohibited distribution. A policy can be well written but fail to detect the real route.
The BETTIMES AML explainer and transaction monitoring guide describe the difference between policy, data, alert, investigation and recorded decision.
How suppliers can test market access
- Maintain a current inventory of operator customers, brands, domains, sub-licensees and technical routes.
- Map each destination market to the required consumer-facing permission.
- Detect domains and traffic patterns that do not match the approved customer inventory.
- Reassess risk after new integrations, ownership changes, products or payment methods.
- Escalate mismatches to compliance and commercial owners with a documented stop or remediation decision.
- Test whether contractual restrictions are visible in actual game access and telemetry.
These are general controls suggested by the case. They are not a claim about the confidential system Evolution used before or after remediation.
What remediation the regulator recorded
The Commission said Evolution responded swiftly and comprehensively after the issues were identified and strengthened its controls. It also stated that subsequent testing had not identified further instances of concern at the time of the announcement.
The settlement varies the operating licence by adding a condition requiring an independent audit of relevant policies, procedures and controls within 12 months of the review's conclusion. That requirement creates a future assurance step.
BETTIMES reports these points as statements from the regulator. It does not independently certify the remediated system or predict the audit result.
What the case does not establish
The Commission's public news release does not identify the six domains or two operators. It does not say that every Evolution game, customer or market was affected. It also does not establish that the supplier deliberately targeted unlicensed British consumers.
The findings concern risk assessment, control effectiveness and customer due diligence under the named licences. Any stronger statement would need additional evidence.
An official freedom-of-information page published later still points readers to the July public statement rather than supplying the requested names. That reinforces the need to keep those entities unknown.
Why B2B licences need destination-market controls
A supplier licence regulates the supplier's activity, but games can travel through distribution chains that cross borders. A customer licensed in one place may operate several brands or technical routes. The supplier needs a current view of where its products are accessible in practice.
This is not the same as making the supplier the consumer operator. Each entity retains its own role. The control objective is to prevent licensed supply from supporting access that falls outside the approved market chain.
The BETTIMES licence verification guide can be applied at every consumer hostname, while supplier due diligence keeps the commercial and technical relationships connected behind it.
Frequently asked questions
How much will Evolution Malta pay?
The Gambling Commission says Evolution Malta Holding Limited will make a £4.75 million payment in lieu of a financial penalty under the regulatory settlement published on 23 July 2026. The public statement also records Commission costs and a licence condition requiring an independent audit.
Were the Evolution games fake?
No. The Commission's public statement describes five genuine Evolution games found on six unlicensed websites. The regulatory concern was that licensed products were available through operators that did not hold the required British permission, together with weaknesses in the supplier's risk assessment and controls.
Did Evolution operate the six websites?
The source says the six websites were operated by two unlicensed operators and that Evolution supplied games within the chain. It does not say Evolution was the consumer-facing operator of those sites. The case should be reported as a B2B supply-control matter with distinct legal roles.
What period did the case cover?
The Commission says there were large volumes of visits from UK consumers to the six websites between December 2023 and November 2024. The settlement was published on 23 July 2026. Those are different dates: one describes observed access, and the other records the regulatory outcome.
What happens next?
An additional licence condition requires an independent audit of relevant policies, procedures and controls within 12 months of the licence review's conclusion. The Commission also reported that Evolution had strengthened controls and that its subsequent testing had not identified further instances of concern at publication time.
The current position
The Evolution settlement shows that a B2B licence needs live destination-market and customer controls, not only contracts and a static risk assessment. The reliable account preserves the five games, six sites, two operators, access period and 12-month audit condition while leaving unpublished identities unknown.